IBM and its subsidiary Red Hat have launched a $5 billion initiative, called Project Lightwell, to improve the security of open source software across enterprise supply chains.